FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Kraven2323
Staff
Staff
Article Id 333353

Description

This article describes, with an example, how the 'route-map-out-preferable' functions in the BGP route-tag and is used concurrently with an SD-WAN rule.

Scope

FortiGate.

Solution

Prerequisites:

  1. SD-WAN with 'SLA' and 'config neighbor'. See the documentation.

  2. BGP with route-map. See the documentation.

 

The scenario below is the route-tag in HUB for the BGP route from Branch when SLA is met:

 

Kraven2323_24-1723684629128.png

 

In this scenario, the SD-WAN rule in the HUB was configured to follow the route tagging.

 

Kraven2323_25-1723684629130.png

 

Consider the SD-WAN rule for Dialup_1_1, which is meeting the SLA first.

 

Kraven2323_26-1723684629132.png

 

In Branch, the route-map is configured to have route-map-out-preferable when SLA is met and route-map-out when SLA is not met.

 

Kraven2323_27-1723684629133.png

 

Kraven2323_28-1723684629135.png

 

Now, make the Dialup_1_1 fail the SLA from the branch.


Note the route-tag for the Dialup_1_1 is changed to 5.

 

Kraven2323_29-1723684629137.png

 

Note that the SD-WAN rule will not be matched as the route-tag is not matching.

 

Kraven2323_30-1723684629138.png

 

This will cause the traffic to use other SD-WAN rules which match the SLA.

When the SLA recovers, the SD-WAN rule will be used again.

 

Kraven2323_31-1723684629143.png

 

Additional detailed testing scenario:

SD-WAN self-healing with BGP - FortiGate documentation.

Contributors